The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and technology firm Hackerbella Ltd over allegations that students’ personal information was used to create bank accounts without their knowledge or a lawful basis.

The commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, disclosed this on Wednesday in Abuja, saying the probe followed complaints from members of the public.

According to Bamigboye, the National Commissioner of the NDPC, Dr Vincent Olatunji, ordered a comprehensive examination of how the affected students’ data were collected, processed and shared by the institutions involved.

He said the investigation would establish the respective roles of UNILAG, Lotus Bank and Hackerbella Ltd in the alleged processing of the students’ information and determine whether their actions complied with the Nigeria Data Protection Act 2023.

The probe will also examine whether the opening of the bank accounts was supported by a valid legal basis and whether the affected students were adequately informed about how their personal information would be used.

Bamigboye said investigators would assess several aspects of the organisations’ data-handling practices, including the conduct of Data Protection Impact Assessments, the legality and transparency of credit scoring and profiling, as well as the deployment of automated decision-making systems.

The commission will further scrutinise privacy notices, data-sharing agreements, consent and other lawful grounds for processing, data minimisation and purpose limitation practices, retention policies, and the technical and organisational measures put in place to protect students’ rights.

Bamigboye stressed that organisations entrusted with personal information have an obligation to ensure that such data are handled lawfully, fairly, transparently and securely.

He described the investigation as part of the commission’s wider effort to tackle data protection compliance gaps within Nigeria’s education sector and warned institutions that have yet to meet existing regulatory requirements to take compliance seriously.

The latest probe comes amid increased efforts by the NDPC to strengthen privacy protection as the use of digital technologies and data-driven services expands across the country.

In March, the commission warned content creators against recording or photographing unsuspecting individuals and publishing such material online without appropriate consent, noting that such practices could infringe on privacy and data protection rights.

The NDPC also partnered with private-sector ICT companies in May to explore regulatory sandboxes for artificial intelligence and data protection, while in June it announced plans to review the Nigeria Data Protection Act 2023 to better address emerging technologies such as AI, big data and robotics.

The commission had earlier commenced an investigation in April into an alleged data breach involving the Corporate Affairs Commission, underscoring its growing focus on protecting personal information and strengthening confidence in Nigeria’s digital ecosystem.